Certified Network Defender (CND) v2 Exam (312-38) — Questions and Answers

Question 1: Which technology can be used to detect ARP spoofing attacks on a switched network?

Dynamic ARP Inspection (DAI) (Correct answer)
OSPF authentication
Spanning Tree Protocol (STP)
DHCP snooping alone

Correct answer: Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection validates ARP packets against a DHCP snooping binding table, dropping ARP replies that don't match the legitimate IP-to-MAC mappings.

Question 2: What is the main advantage of an out-of-band (OOB) management network for network device administration?

It provides real-time encryption for management sessions
It automatically patches firmware on network devices
It increases bandwidth for production traffic
It keeps management traffic separate so devices remain accessible during attacks or outages (Correct answer)

Correct answer: It keeps management traffic separate so devices remain accessible during attacks or outages

An out-of-band management network uses separate physical interfaces or dedicated networks, ensuring administrators can access and control devices even when the production network is compromised or down.

Question 3: Which of the following protocols is used to secure communications on the internet?

HTTP
TLS (Transport Layer Security) (Correct answer)
Telnet
FTP

Correct answer: TLS (Transport Layer Security)

TLS (Transport Layer Security) is a cryptographic protocol designed to provide communication security over a computer network. It is widely used for securing web browsing (HTTPS), email, and other data transfers, ensuring data privacy and integrity between communicating applications. HTTP, FTP, and Telnet are older protocols that either lack inherent security or are less secure.

Question 4: What is the security purpose of disabling USB ports on corporate endpoints?

Prevent data exfiltration and introduction of malware via removable media (Correct answer)
Reduce power consumption
Improve system boot speed
Improve keyboard and mouse performance

Correct answer: Prevent data exfiltration and introduction of malware via removable media

Disabling or controlling USB ports prevents attackers or insiders from copying sensitive data to thumb drives or introducing malware-infected media.

Question 5: An IR team uses the term 'IoC' during an investigation. What does IoC stand for and what is its purpose?

Integrity of Configuration — validates system baseline settings
Indicator of Compromise — artifacts that signal a system has been breached (Correct answer)
Instance of Control — defines which team member owns each task
Index of Compromise — tracks patch levels on endpoints

Correct answer: Indicator of Compromise — artifacts that signal a system has been breached

Indicators of Compromise (IoCs) are forensic artifacts such as malicious IPs, file hashes, or registry keys that indicate a system has been compromised.

Question 6: Wardriving is a reconnaissance technique used to discover wireless networks. Which tool combination is most commonly associated with wardriving on Linux?

Airsnort + John the Ripper
Nmap + Metasploit
Kismet + GPS receiver (Correct answer)
Wireshark + Burp Suite

Correct answer: Kismet + GPS receiver

Kismet is a passive wireless network detector and sniffer, and when combined with a GPS receiver it can map discovered networks geographically, which is the core capability used in wardriving.

Question 7: A network engineer wants to prevent rogue DHCP servers on a LAN. Which switch feature should be enabled?

Port Security
Dynamic ARP Inspection
DHCP Snooping (Correct answer)
Storm Control

Correct answer: DHCP Snooping

DHCP Snooping validates DHCP messages and restricts DHCP server responses to trusted ports only.

Question 8: How does Virtual Private Network (VPN) enhance network security?

By compressing network traffic
By allowing unencrypted data to flow freely over the network
By preventing any network traffic from reaching external destinations
By securing the connection and encrypting data transmission (Correct answer)

Correct answer: By securing the connection and encrypting data transmission

A Virtual Private Network (VPN) creates a secure, encrypted connection over a less secure network, such as the internet. It encrypts all data transmitted between the user's device and the VPN server, making it unreadable to unauthorized parties. This ensures privacy and protects sensitive information from eavesdropping and tampering, effectively extending a private network across a public one.

Question 9: Which evidence collection principle states that the most volatile data must be collected before less volatile data?

Order of Volatility (Correct answer)
Chain of Custody
Locard's Exchange Principle
Least Privilege Evidence Handling

Correct answer: Order of Volatility

The Order of Volatility (RFC 3227) dictates collecting data from most volatile (RAM, CPU registers) to least volatile (optical media, paper) to prevent loss of perishable evidence.

Question 10: What is a zero-day vulnerability?

A vulnerability that is exploited immediately upon discovery, without a fix available (Correct answer)
A vulnerability that has been identified but not yet exploited
A vulnerability that is intentionally introduced into the system
A vulnerability that has been patched and is no longer a threat

Correct answer: A vulnerability that is exploited immediately upon discovery, without a fix available

A zero-day vulnerability is a software flaw that is unknown to the vendor or public and has no available patch or fix. Attackers can exploit these vulnerabilities "on day zero" of their discovery, often before the vendor is even aware of the issue. This makes zero-day exploits particularly dangerous as there is no immediate defense against them.

Question 11: A threat agent exploits a software vulnerability to gain unauthorized access. In risk terminology, what is the 'threat agent'?

The impact of the successful attack
The weakness in the software
The entity that takes advantage of the vulnerability (Correct answer)
The control designed to prevent exploitation

Correct answer: The entity that takes advantage of the vulnerability

A threat agent (or threat actor) is the person, group, or entity that initiates and carries out an attack by exploiting a vulnerability.

Question 12: Which of the following best describes 'fileless malware' and why it is challenging to detect?

Malware embedded in PDF metadata
Malware stored in encrypted ZIP archives
A virus that overwrites system files
Malicious code that executes entirely in memory without writing files to disk, evading file-based AV (Correct answer)

Correct answer: Malicious code that executes entirely in memory without writing files to disk, evading file-based AV

Fileless malware runs entirely in memory (often via scripting engines like PowerShell), leaving no files on disk and evading traditional signature-based antivirus detection.

Question 13: What distinguishes a Certified Network Defender certified professional from a non-certified practitioner?

There is no meaningful difference in competency
Certified professionals exclusively work in larger organizations
Certification validates competency through standardized assessment against established benchmarks (Correct answer)
Certified professionals always have more years of experience

Correct answer: Certification validates competency through standardized assessment against established benchmarks

Certification provides objective validation of competency through standardized assessment. While non-certified practitioners may be skilled, certification offers verified evidence that a professional meets established benchmarks for knowledge and performance.

Question 14: What is the PRIMARY purpose of obtaining CND certification in Certified Network Defender?

To demonstrate verified competency and adherence to professional standards (Correct answer)
To bypass educational requirements
To satisfy a personal achievement goal
To guarantee employment in the field

Correct answer: To demonstrate verified competency and adherence to professional standards

Professional certification demonstrates that an individual has met established competency standards through verified assessment. It provides assurance to employers, clients, and the public that the certified professional possesses the knowledge and skills required for competent practice.

Question 15: Which IEEE 802.11 amendment introduced MU-MIMO and operates in the 6 GHz band in addition to 2.4 GHz and 5 GHz?

802.11g
802.11ac (Wi-Fi 5)
802.11ax (Wi-Fi 6/6E) (Correct answer)
802.11n (Wi-Fi 4)

Correct answer: 802.11ax (Wi-Fi 6/6E)

802.11ax (Wi-Fi 6/6E) supports MU-MIMO, OFDMA, and in its 6E variant operates in the 6 GHz band, offering greater capacity and reduced interference compared to earlier standards.

Question 16: How should a CND professional manager address underperformance within their team?

Immediately reassign the individual to a different role
Publicly address the issue in team meetings
Ignore it until formal review periods
Provide timely, specific feedback with support and a clear improvement plan (Correct answer)

Correct answer: Provide timely, specific feedback with support and a clear improvement plan

Addressing underperformance requires timely intervention with specific, objective feedback about the performance gap. Providing support resources and a clear improvement plan with defined expectations and timelines gives the individual a fair opportunity to improve.

Question 17: What is the primary purpose of risk management in cybersecurity?

To delay response to security incidents
To assess, prioritize, and mitigate risks to protect systems and data (Correct answer)
To increase the likelihood of security breaches
To ignore potential threats

Correct answer: To assess, prioritize, and mitigate risks to protect systems and data

The primary purpose of risk management in cybersecurity is to proactively identify, analyze, and evaluate potential threats and vulnerabilities to an organization's assets. By assessing the likelihood and impact of these risks, organizations can prioritize and implement appropriate controls and mitigation strategies. This systematic approach aims to protect systems and data from harm while aligning with business objectives.

Question 18: In the context of network defense, what is the purpose of a bastion host?

A hardened host providing a single access point between public and private networks (Correct answer)
A system that stores centralized authentication credentials
A device that load balances incoming web traffic
A server used solely for data backup

Correct answer: A hardened host providing a single access point between public and private networks

A bastion host is a specially hardened system exposed to the internet that acts as a gateway into an internal network, minimizing the attack surface through strict configuration.

Question 19: When assessment results for a Certified Network Defender evaluation are inconclusive, the BEST practice is to:

Conduct additional assessment using alternative methods (Correct answer)
Report the results as definitive anyway
Discard the results and start over completely
Delay reporting until results are favorable

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods to gather more data. This triangulation approach helps clarify findings without compromising the integrity of the assessment process.

Question 20: What is the primary security weakness of Wired Equivalent Privacy (WEP)?

It requires 802.1X which is difficult to implement
It uses 128-bit keys which are too long to be practical
It relies on RC4 with static, reused initialization vectors making it trivially crackable (Correct answer)
It lacks mutual authentication but provides strong encryption

Correct answer: It relies on RC4 with static, reused initialization vectors making it trivially crackable

WEP reuses 24-bit IVs and uses a flawed implementation of RC4, allowing attackers to collect enough packets to statistically recover the key in minutes using tools like Aircrack-ng.

Question 21: Why is threat intelligence crucial for vulnerability management?

To provide insights into new and evolving threats for proactive defense (Correct answer)
To track and exploit security weaknesses
To limit threat monitoring to specific regions
To prevent the implementation of security measures

Correct answer: To provide insights into new and evolving threats for proactive defense

Threat intelligence is crucial for vulnerability management because it provides organizations with up-to-date information about current and emerging cyber threats, attack methodologies, and threat actors. This intelligence allows security teams to proactively identify and prioritize vulnerabilities that are most likely to be exploited by real-world threats. It enables a more informed and strategic approach to defense.

Question 22: What is the purpose of log normalization in a SIEM system?

Encrypting logs to prevent tampering
Forwarding alerts to the incident response team
Deleting old logs to free storage space
Converting logs from different sources into a common format for correlation (Correct answer)

Correct answer: Converting logs from different sources into a common format for correlation

Log normalization converts disparate log formats from different vendors and systems into a standardized schema, enabling the SIEM to correlate events across multiple data sources effectively.

Question 23: What is 'log tampering' and why is it a concern in forensic investigations?

Converting logs to a binary format
Compressing logs to save disk space
Backing up logs to a remote server
An attacker deleting or modifying logs to cover their tracks (Correct answer)

Correct answer: An attacker deleting or modifying logs to cover their tracks

Log tampering involves an attacker deleting, modifying, or disabling logs to erase evidence of their unauthorized activities.

Question 24: A CND practitioner wants to isolate wireless guest users from the internal corporate network while using the same physical AP infrastructure. Which technology best achieves this?

Enabling WPS on the guest SSID
Disabling DHCP for guest clients
VLAN-based SSID segmentation with separate VLANs per SSID (Correct answer)
MAC address filtering on the AP

Correct answer: VLAN-based SSID segmentation with separate VLANs per SSID

Mapping each SSID to a separate VLAN allows the same physical infrastructure to carry multiple logical networks, with firewall rules between VLANs enforcing isolation between guest and corporate traffic.

Question 25: Which proxy server type hides the identity of internal clients by substituting its own IP address in outbound requests?

Reverse proxy
Forward proxy (Correct answer)
Transparent proxy
SOCKS proxy

Correct answer: Forward proxy

A forward proxy acts on behalf of internal clients making outbound requests, masking their identities and providing content filtering, caching, and access control.

Question 26: Which VPN protocol is widely considered the most secure for site-to-site enterprise VPN connections due to its robust authentication and encryption?

IPSec IKEv2 (Correct answer)
SSTP
PPTP
L2TP/IPSec

Correct answer: IPSec IKEv2

IPSec with IKEv2 provides strong mutual authentication, perfect forward secrecy, and is highly resilient to network changes, making it the preferred choice for enterprise VPNs.

Question 27: A network defender discovers an access point broadcasting with the corporate SSID but with a different BSSID than the legitimate AP. What type of device has most likely been deployed?

A rogue access point impersonating the corporate network (Correct answer)
A wireless bridge for a wired segment
A mesh network node
A repeater extending network coverage

Correct answer: A rogue access point impersonating the corporate network

A rogue access point broadcasting the same SSID with a different BSSID is a classic indicator of an evil twin or unauthorized AP designed to lure clients into connecting to an attacker-controlled device.

Question 28: Which compliance regulation applies to US financial institutions and requires them to protect the security and confidentiality of customer financial information?

FERPA
COPPA
GLBA (Correct answer)
FISMA

Correct answer: GLBA

The Gramm-Leach-Bliley Act (GLBA) requires US financial institutions to implement safeguards to protect nonpublic personal financial information.

Question 29: What is the significance of timestamps in log analysis during a forensic investigation?

They determine log file size
They compress log data
They encrypt log entries
They establish the sequence and timing of events (Correct answer)

Correct answer: They establish the sequence and timing of events

Accurate timestamps allow investigators to build a chronological timeline correlating events across multiple systems.

Question 30: Under HIPAA, which rule specifically requires covered entities to implement administrative, physical, and technical safeguards for electronic PHI?

Security Rule (Correct answer)
Enforcement Rule
Breach Notification Rule
Privacy Rule

Correct answer: Security Rule

The HIPAA Security Rule requires covered entities to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI).

Question 31: What is the function of a Host-Based Intrusion Prevention System (HIPS)?

Encrypt files on the host's hard drive
Manage network firewall rules centrally
Monitor and block suspicious activities on an individual endpoint in real time (Correct answer)
Scan email attachments for malware

Correct answer: Monitor and block suspicious activities on an individual endpoint in real time

HIPS monitors system calls, file access, registry changes, and network connections on the host, blocking actions that match malicious behavior patterns.

Question 32: In NIST SP 800-30, what is the correct order of the risk assessment process?

Determine impact, identify threats, assess controls, determine likelihood
Identify vulnerabilities, determine impact, identify threats, assess controls
Identify threats, identify vulnerabilities, determine likelihood, determine impact (Correct answer)
Assess controls, identify threats, determine impact, identify vulnerabilities

Correct answer: Identify threats, identify vulnerabilities, determine likelihood, determine impact

NIST SP 800-30 follows: identify threats, identify vulnerabilities, determine likelihood, then determine impact to derive overall risk.

Question 33: How does the CND body of knowledge relate to daily professional practice?

It is theoretical and has limited practical application
It is relevant only for academic research
It only applies during certification exams
It provides the foundational framework that guides decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 34: Which Windows feature uses virtualization to protect the integrity of the OS kernel from rootkits?

Windows Defender Firewall
Credential Guard
Virtualization-Based Security (VBS) / Hypervisor-Protected Code Integrity (HVCI) (Correct answer)
BitLocker

Correct answer: Virtualization-Based Security (VBS) / Hypervisor-Protected Code Integrity (HVCI)

VBS with HVCI uses hardware virtualization to isolate kernel code integrity checks in a protected environment, preventing kernel-level rootkits from tampering with the OS.

Question 35: What is the primary purpose of implementing log retention policies in a security operations program?

To automatically delete all logs after 24 hours to save storage
To prevent security analysts from accessing sensitive log data
To compress log files for faster SIEM ingestion
To ensure logs are available for forensic investigation, compliance requirements, and long-term trend analysis (Correct answer)

Correct answer: To ensure logs are available for forensic investigation, compliance requirements, and long-term trend analysis

Log retention policies define how long logs must be kept to support forensic investigations after a breach, satisfy regulatory compliance mandates (e.g., PCI-DSS, HIPAA), and enable historical trend analysis.

Question 36: What does 'log retention policy' define in an enterprise security program?

How long logs must be stored before deletion (Correct answer)
Who can create new log sources
How logs are encrypted in transit
The format logs are stored in

Correct answer: How long logs must be stored before deletion

A log retention policy specifies the minimum duration logs must be preserved to support forensic investigations, audits, and regulatory compliance.

Question 37: Which EAP method provides the strongest security by requiring both the client and the authentication server to present digital certificates?

EAP-TLS (Correct answer)
LEAP
EAP-MD5
EAP-FAST

Correct answer: EAP-TLS

EAP-TLS requires mutual certificate-based authentication — both the supplicant and the RADIUS server present X.509 certificates — making it immune to password-based attacks and the most secure EAP method.

Question 38: During incident response, when should an organization notify law enforcement?

Law enforcement should never be involved in cyber incidents
When the incident involves criminal activity, significant financial loss, or national security implications (Correct answer)
Only if the incident involves physical theft of hardware
Only after the incident is fully remediated

Correct answer: When the incident involves criminal activity, significant financial loss, or national security implications

Law enforcement notification is appropriate when incidents involve criminal activity (e.g., ransomware, financial fraud), critical infrastructure, or meet reporting thresholds under applicable laws.

Question 39: What is the primary purpose of a DMZ (Demilitarized Zone) in network architecture?

To encrypt internal traffic
To monitor user activity logs
To isolate public-facing servers from the internal network (Correct answer)
To provide redundant routing paths

Correct answer: To isolate public-facing servers from the internal network

A DMZ is a network segment that isolates publicly accessible servers (like web and mail servers) from the trusted internal network, limiting exposure if those servers are compromised.

Question 40: What is the purpose of Windows Defender Credential Guard?

Encrypt credentials in transit over the network
Isolate and protect NTLM/Kerberos credential hashes in a virtualized container from theft (Correct answer)
Enforce password complexity on domain accounts
Scan credentials stored in browsers for malware

Correct answer: Isolate and protect NTLM/Kerberos credential hashes in a virtualized container from theft

Credential Guard uses VBS to store NTLM and Kerberos credential material in an isolated hypervisor-protected environment, preventing Pass-the-Hash and Pass-the-Ticket attacks.

Question 41: Which disaster recovery metric defines the maximum age of data that an organization can afford to lose in a disruption?

MTTR (Mean Time to Repair)
RTO (Recovery Time Objective)
RPO (Recovery Point Objective) (Correct answer)
MTBF (Mean Time Between Failures)

Correct answer: RPO (Recovery Point Objective)

RPO (Recovery Point Objective) defines how much data loss is tolerable, directly determining how frequently backups must be taken.

Question 42: Which Bluetooth attack allows an attacker to pair with a device without the owner's knowledge and access calendar, contacts, and messages?

BIAS (Bluetooth Impersonation Attack)
BlueSmack
Bluesnarfing (Correct answer)
Bluejacking

Correct answer: Bluesnarfing

Bluesnarfing exploits vulnerabilities in OBEX Push Profile or OBEX File Transfer Profile to access sensitive data on a Bluetooth device without user authorization or authentication.

Question 43: Which backup strategy captures only the data changed since the LAST INCREMENTAL backup, resulting in the fastest backup but slowest restore?

Differential backup
Full backup
Incremental backup (Correct answer)
Mirror backup

Correct answer: Incremental backup

Incremental backups only capture changes since the previous backup (full or incremental), making them fast to create but requiring all increments to be restored sequentially, slowing recovery.

Question 44: What is the purpose of a security baseline configuration for endpoints?

Define the maximum performance settings
Configure network routing tables
Establish a minimum secure configuration standard all endpoints must meet (Correct answer)
Determine which users can access the endpoint

Correct answer: Establish a minimum secure configuration standard all endpoints must meet

A security baseline defines the minimum required security settings—such as password policies, enabled services, and audit logging—that every endpoint in the organization must comply with.

Question 45: How does the CND body of knowledge relate to daily professional practice?

It is theoretical and has limited practical application
It only applies during certification exams
It is relevant only for academic research
It provides the foundational framework that guides decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework that guides decision-making and standard practices

Question 46: A company's BCP states that critical payroll processing must continue even if the primary data center is destroyed. Which strategy BEST meets this requirement?

Manual processing using paper records
Cold site provisioned within 72 hours
Weekly tape backups stored offsite
Hot site with real-time data replication (Correct answer)

Correct answer: Hot site with real-time data replication

A hot site with real-time replication ensures zero data loss and near-instant failover, making it the only option that can sustain critical operations immediately after a site-level disaster.

Question 47: What is the BEST strategy for resource allocation in Certified Network Defender project management?

Keep significant reserves without deployment
Allocate all resources equally regardless of need
Focus resources only on the largest tasks
Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Effective resource allocation requires matching available resources to priorities determined by assessment of needs, risk factors, and strategic goals. This ensures that critical areas receive appropriate support while maintaining overall efficiency.

Question 48: A security engineer needs to ensure data integrity without confidentiality for routing protocol updates. Which IPsec mode is most appropriate?

IKEv1 Aggressive mode
AH in Transport mode (Correct answer)
ESP in Tunnel mode
ESP in Transport mode

Correct answer: AH in Transport mode

AH in Transport mode authenticates the packet payload and IP header without encrypting data, providing integrity only.

Question 49: Which of the following is a best practice for ensuring log integrity in a forensic context?

Store logs only on the monitored host
Rotate logs every hour and delete the previous copy
Forward logs in real time to a remote write-once log server (Correct answer)
Disable logging on high-traffic systems to reduce noise

Correct answer: Forward logs in real time to a remote write-once log server

Forwarding logs in real time to an isolated, write-once remote server prevents attackers who compromise the source system from tampering with log evidence.

Question 50: What is the primary objective of an incident response plan in cybersecurity?

To increase the number of users affected by the incident
To ignore incidents and continue with normal operations
To quickly detect, respond, and recover from a security incident to minimize damage (Correct answer)
To delay the response until further analysis is completed

Correct answer: To quickly detect, respond, and recover from a security incident to minimize damage

An incident response plan provides a structured approach for an organization to handle cybersecurity incidents. Its primary objective is to enable a rapid and effective response to security breaches, limiting their impact, restoring normal operations as quickly as possible, and learning from the incident to prevent future occurrences. This minimizes financial, reputational, and operational damage.

Question 51: What is the primary goal of OS hardening in a network defender's role?

Install the latest productivity software
Increase system performance
Reduce the attack surface by disabling unnecessary services and features (Correct answer)
Enable remote desktop on all workstations

Correct answer: Reduce the attack surface by disabling unnecessary services and features

OS hardening removes or disables unused services, accounts, and features, reducing the number of potential vulnerabilities an attacker can exploit.

Question 52: Which Windows event log ID is associated with a successful user logon?

4625
4624 (Correct answer)
4720
4648

Correct answer: 4624

Windows Event ID 4624 is generated each time a user successfully logs on to the system.

Question 53: How does the CND body of knowledge relate to daily professional practice?

It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It is relevant only for academic research
It is theoretical and has limited practical application
It only applies during certification exams

Correct answer: It provides the foundational framework that guides decision-making and standard practices

Question 54: Which CND control specifically addresses preventing unauthorized software execution on endpoints through policy-based restrictions?

Software Restriction Policies (SRP) or AppLocker (Correct answer)
Intrusion Detection System (IDS)
Network Access Control (NAC)
Dynamic Host Configuration Protocol (DHCP)

Correct answer: Software Restriction Policies (SRP) or AppLocker

Windows Software Restriction Policies and AppLocker enforce rules that allow or deny execution of applications based on path, publisher certificate, or file hash.

Question 55: In Certified Network Defender, what is the PRIMARY purpose of conducting an initial assessment?

To generate documentation for billing purposes
To demonstrate the assessor's expertise
To establish a baseline and identify needs for appropriate action (Correct answer)
To fulfill administrative paperwork requirements

Correct answer: To establish a baseline and identify needs for appropriate action

The initial assessment establishes a baseline of current conditions and identifies specific needs. This foundational information guides all subsequent decisions, planning, and interventions.

Question 56: Which network security measure is used to authenticate users based on their physical characteristics?

Biometric authentication (Correct answer)
Smartcards
Username and password combinations
Password protection

Correct answer: Biometric authentication

Biometric authentication verifies a user's identity based on unique physical or behavioral characteristics. Examples include fingerprints, facial recognition, iris scans, or voice patterns. This method offers a high level of security because biometric traits are difficult to replicate or steal, making it a robust way to authenticate users.

Question 57: What does UEBA (User and Entity Behavior Analytics) add to traditional SIEM capabilities?

Automated firewall rule deployment
Hardware asset inventory management
Machine learning-based detection of anomalous behavior patterns for users and devices (Correct answer)
Real-time malware signature scanning

Correct answer: Machine learning-based detection of anomalous behavior patterns for users and devices

UEBA uses machine learning to build behavioral baselines for users and entities, detecting deviations that may indicate insider threats, compromised accounts, or advanced persistent threats that evade signature-based detection.

Question 58: What is the role of penetration testing in threat assessment?

To make systems more vulnerable to attacks
To eliminate all threats from the network
To simulate attacks and identify vulnerabilities in a network or system (Correct answer)
To focus only on reducing the number of network users

Correct answer: To simulate attacks and identify vulnerabilities in a network or system

Penetration testing, often called ethical hacking, involves authorized simulated cyberattacks against a computer system, network, or web application. Its purpose is to identify exploitable vulnerabilities and security weaknesses that an attacker could leverage. This proactive testing helps organizations understand their security posture and improve defenses before real attacks occur.

Question 59: Which tool is commonly used for capturing and analyzing raw network packets during forensic investigation?

Aircrack-ng
Wireshark (Correct answer)
Nessus
Metasploit

Correct answer: Wireshark

Wireshark is the industry-standard open-source packet analyzer used to capture and inspect raw network traffic during forensic investigations.

Question 60: What does the concept of containment refer to during an incident response?

To stop responding to the incident
To speed up the attack on the network
To allow the breach to spread and infect more systems
To limit the spread of the incident, minimizing further damage (Correct answer)

Correct answer: To limit the spread of the incident, minimizing further damage

Containment is a critical phase in incident response where the primary goal is to stop the spread of a security incident and prevent further damage to systems and data. This might involve isolating affected systems, disconnecting networks, or blocking malicious traffic. Effective containment is essential to prevent a localized incident from becoming a widespread disaster.

Question 61: KRACK (Key Reinstallation Attack) targets which phase of the WPA2 protocol?

The RADIUS authentication exchange
The 4-way handshake used to establish session keys (Correct answer)
The DHCP IP address assignment process
The initial beacon and probe response exchange

Correct answer: The 4-way handshake used to establish session keys

KRACK manipulates retransmissions in the WPA2 4-way handshake to force nonce reuse, allowing decryption and potentially injection of traffic by reinstalling an already-in-use cryptographic key.

Question 62: Which risk treatment option involves transferring the financial impact of a risk to a third party?

Risk mitigation
Risk transference (Correct answer)
Risk acceptance
Risk avoidance

Correct answer: Risk transference

Risk transference shifts the financial burden of a risk to another party, such as purchasing cyber insurance.

Question 63: What is the significance of incident response testing?

To test the plan’s effectiveness and make necessary improvements (Correct answer)
To focus solely on monitoring systems without action
To prevent any incidents from happening
To delay incident response processes

Correct answer: To test the plan’s effectiveness and make necessary improvements

Incident response testing is essential for validating the effectiveness of an organization's incident response plan. By simulating real-world scenarios, testing helps identify weaknesses, gaps, and areas where the plan might fail under pressure. This allows for necessary adjustments and improvements, ensuring that the organization is well-prepared to handle actual security incidents efficiently.

Question 64: Which wireless intrusion detection/prevention capability detects rogue access points by comparing detected BSSIDs against an authorized AP list and alerts on unauthorized devices?

ARP inspection on the distribution layer
Wireless IDS (WIDS) with AP monitoring (Correct answer)
Network Access Control (NAC) enforcement
DHCP snooping on the wired switch

Correct answer: Wireless IDS (WIDS) with AP monitoring

A Wireless IDS (WIDS) continuously monitors the RF environment, catalogs all detected APs, and compares them against the authorized AP database to alert defenders when unknown or rogue APs appear.

Question 65: Which compliance framework specifically addresses the security of payment card data?

HIPAA
PCI DSS (Correct answer)
GLBA
SOX

Correct answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for organizations that handle credit and debit card transactions.

Question 66: Which metric in a SOC measures the time from when an attack begins to when the security team first detects it?

Mean Time to Detect (MTTD) (Correct answer)
Recovery Time Objective (RTO)
Mean Time to Recover (MTTR)
Mean Time Between Failures (MTBF)

Correct answer: Mean Time to Detect (MTTD)

Mean Time to Detect (MTTD) measures the average duration between the start of a security incident and its detection by the SOC, with lower values indicating better monitoring effectiveness.

Question 67: What is the PRIMARY purpose of obtaining CND certification in Certified Network Defender?

To bypass educational requirements
To satisfy a personal achievement goal
To guarantee employment in the field
To demonstrate verified competency and adherence to professional standards (Correct answer)

Correct answer: To demonstrate verified competency and adherence to professional standards

Question 68: Which technique do attackers use to bypass application whitelisting by abusing trusted, pre-approved system tools?

ARP spoofing
Cross-site scripting
SQL injection
Living off the Land (LotL) attacks using LOLBins (Correct answer)

Correct answer: Living off the Land (LotL) attacks using LOLBins

Living off the Land attacks abuse legitimate, pre-approved system binaries (LOLBins) like PowerShell, certutil, or mshta to execute malicious code within whitelisting policies.

Question 69: What is baseline monitoring in the context of network security operations?

Running daily vulnerability scans against all systems
Documenting all installed software versions
Creating backup copies of network configurations
Establishing normal network behavior patterns to identify anomalies (Correct answer)

Correct answer: Establishing normal network behavior patterns to identify anomalies

Baseline monitoring captures normal network traffic patterns, bandwidth usage, and system behavior so that deviations indicating potential security incidents can be detected.

Question 70: Which step of the NIST RMF involves categorizing information systems based on the potential impact of a security breach?

Categorize (Correct answer)
Implement
Authorize
Select

Correct answer: Categorize

The Categorize step uses FIPS 199 and NIST SP 800-60 to classify systems based on the potential impact (low, moderate, high) of a confidentiality, integrity, or availability breach.

Question 71: Which wireless security protocol introduced Simultaneous Authentication of Equals (SAE) to replace the Pre-Shared Key (PSK) handshake and eliminate offline dictionary attacks?

WPA2-Personal
WPA2-Enterprise
WEP2
WPA3-Personal (Correct answer)

Correct answer: WPA3-Personal

WPA3-Personal replaces PSK with SAE (a Dragonfly-based handshake), which is resistant to offline dictionary attacks because an attacker cannot test a captured handshake without interacting with the network each time.

Question 72: What is the function of Network Address Translation (NAT) as a security control?

Hides internal IP address space from external networks (Correct answer)
Encrypts outbound traffic
Provides authentication for web sessions
Blocks malicious URLs

Correct answer: Hides internal IP address space from external networks

NAT maps private internal IP addresses to a public address, obscuring the internal network topology from external observers.

Question 73: When assessment results for a Certified Network Defender evaluation are inconclusive, the BEST practice is to:

Delay reporting until results are favorable
Discard the results and start over completely
Conduct additional assessment using alternative methods (Correct answer)
Report the results as definitive anyway

Correct answer: Conduct additional assessment using alternative methods

Question 74: An attacker sends packets with the SYN flag set to exhaust server connection resources. Which control best mitigates this?

Enabling SYN cookies on the server (Correct answer)
Rate limiting ICMP packets
Disabling UDP on the perimeter firewall
Implementing DNSSEC

Correct answer: Enabling SYN cookies on the server

SYN cookies allow the server to respond to SYN packets without allocating resources until the handshake completes.

Question 75: What is the role of a Certificate Revocation List (CRL) in PKI?

Encrypt private keys
List certificates no longer trusted before expiry (Correct answer)
Validate certificate chain length
Store issued certificates

Correct answer: List certificates no longer trusted before expiry

A CRL is a signed list published by a CA containing serial numbers of certificates that have been revoked before their expiration.

Question 76: What does the term 'chain of custody' mean in the context of network forensics?

The sequence of firewall rules applied to traffic
The order in which logs are rotated
Documented handling of evidence from collection to court presentation (Correct answer)
A VPN tunnel encryption sequence

Correct answer: Documented handling of evidence from collection to court presentation

Chain of custody documents every person who handled digital evidence and every action taken, ensuring admissibility in legal proceedings.

Question 77: What does a next-generation firewall (NGFW) provide that a traditional stateful firewall does not?

Deep packet inspection and application awareness (Correct answer)
Basic packet filtering
Static routing capabilities
Physical port-based filtering

Correct answer: Deep packet inspection and application awareness

NGFWs add deep packet inspection, application identification, user-identity awareness, and integrated threat intelligence beyond the port/protocol filtering of traditional stateful firewalls.

Question 78: What is the PRIMARY purpose of obtaining CND certification in Certified Network Defender?

To demonstrate verified competency and adherence to professional standards (Correct answer)
To satisfy a personal achievement goal
To guarantee employment in the field
To bypass educational requirements

Correct answer: To demonstrate verified competency and adherence to professional standards

Question 79: Which protocol is designed to forward log messages from network devices to a central log server?

SNMP
TACACS+
Syslog (Correct answer)
RADIUS

Correct answer: Syslog

Syslog (RFC 5424) is the standard protocol used by routers, switches, firewalls, and servers to send log messages to a centralized log server.

Question 80: An organization discovers a vulnerability but decides no action is needed because the cost of mitigation exceeds the asset's value. This decision is an example of:

Risk mitigation
Risk acceptance (Correct answer)
Risk avoidance
Risk transference

Correct answer: Risk acceptance

Risk acceptance (also called risk retention) occurs when management consciously chooses to accept a risk, often because mitigation costs outweigh potential loss.

Question 81: An organization implements a proxy that intercepts all outbound HTTP/HTTPS connections and scans content. What type of control is this?

Intrusion Detection System
Unified Threat Management
Forward Proxy with SSL inspection (Correct answer)
Reverse Proxy

Correct answer: Forward Proxy with SSL inspection

A forward proxy with SSL inspection decrypts, inspects, and re-encrypts outbound traffic to enforce content policies and detect threats.

Question 82: A network defender wants to prevent wireless clients from communicating directly with each other on the same AP while still allowing internet access. Which AP feature accomplishes this?

Band steering to separate client types
WMM (Wi-Fi Multimedia) QoS profiles
Client isolation (AP isolation / PSPF) (Correct answer)
Beamforming to direct signals toward the router

Correct answer: Client isolation (AP isolation / PSPF)

Client isolation (sometimes called AP isolation or Publicly Secure Packet Forwarding) blocks Layer 2 traffic between wireless clients on the same SSID, preventing peer-to-peer attacks like ARP poisoning while allowing uplink access.

Question 83: Why is it important to establish cybersecurity policies for an organization?

To make systems easier to hack
To reduce the number of employees working on security tasks
To provide clear rules for securing data and complying with regulations (Correct answer)
To increase the complexity of security measures

Correct answer: To provide clear rules for securing data and complying with regulations

Establishing cybersecurity policies provides clear, documented guidelines for employees on how to handle and protect organizational data and systems. These policies ensure consistent security practices across the organization, define responsibilities, and help ensure compliance with legal and regulatory requirements. They are essential for creating a strong security culture and framework.

Question 84: How does continuous monitoring support risk management?

By blocking all incoming data packets
By slowing down network performance to prevent breaches
By preventing all network traffic
By providing real-time detection of threats and enabling proactive risk mitigation (Correct answer)

Correct answer: By providing real-time detection of threats and enabling proactive risk mitigation

Continuous monitoring supports risk management by providing ongoing, real-time visibility into an organization's security posture and potential threats. This constant oversight allows for immediate detection of anomalies, vulnerabilities, and active attacks, enabling proactive risk mitigation before significant damage occurs. It ensures that security controls remain effective and adapt to evolving threat landscapes.

Question 85: What is the MOST effective way for new CND professionals to build competency in their field?

Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Focusing solely on the most advanced topics
Learning entirely through trial and error
Studying certification materials exclusively

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building professional competency requires a multi-faceted approach: formal education provides foundational knowledge, mentored practice develops applied skills under guidance, and ongoing professional development ensures continuous growth and currency in the field.

Question 86: A chain of custody document in incident response is primarily used to:

Log system performance metrics during recovery
Record which analysts were on call during the incident
Track evidence handling to ensure its integrity and admissibility in legal proceedings (Correct answer)
Document software licenses used during the investigation

Correct answer: Track evidence handling to ensure its integrity and admissibility in legal proceedings

Chain of custody records every person who handled evidence, when, and why, ensuring that evidence integrity can be proven in court or disciplinary proceedings.

Question 87: Which access control model assigns permissions based on job functions defined by an organization, rather than individual identity?

RBAC (Role-Based Access Control) (Correct answer)
ABAC (Attribute-Based Access Control)
MAC (Mandatory Access Control)
DAC (Discretionary Access Control)

Correct answer: RBAC (Role-Based Access Control)

RBAC grants permissions to roles (e.g., admin, auditor) and then assigns users to those roles, simplifying access management.

Question 88: Which SOX section holds executives personally accountable for the accuracy of financial reports and the effectiveness of internal controls?

Section 409
Section 404
Section 802
Section 302 (Correct answer)

Correct answer: Section 302

SOX Section 302 requires CEOs and CFOs to personally certify the accuracy of financial statements and the effectiveness of internal controls.

Question 89: What is the function of Intrusion Detection Systems (IDS)?

To monitor and alert on suspicious activities or breaches (Correct answer)
To scan emails for viruses
To prevent all network traffic
To prevent attacks by blocking incoming traffic

Correct answer: To monitor and alert on suspicious activities or breaches

Intrusion Detection Systems (IDS) are security tools that continuously monitor network or system activities for malicious activities or policy violations. When suspicious patterns or known attack signatures are detected, an IDS generates alerts to security personnel. Its primary role is to detect and notify, rather than to actively block traffic.

Question 90: Why is post-incident analysis important in incident response?

To analyze and improve the response process for future incidents (Correct answer)
To prevent any future response plans
To delay recovery and response time
To blame individuals for the incident

Correct answer: To analyze and improve the response process for future incidents

Post-incident analysis is crucial for learning from security incidents. It involves reviewing what happened, how the response was handled, and identifying areas for improvement in processes, tools, and training. This critical step ensures that organizations can refine their incident response plan, making future responses more efficient and effective.

Question 91: Which assessment method provides the MOST reliable data for CND professionals making critical decisions?

Informal verbal feedback alone
Social media reviews and testimonials
Standardized tools combined with professional observation (Correct answer)
Single-source data from one stakeholder

Correct answer: Standardized tools combined with professional observation

Combining standardized assessment tools with professional observation provides the most reliable and comprehensive data. Standardized tools ensure consistency and validity, while professional observation captures nuances that tools might miss.

Question 92: In risk management, the 'residual risk' is best described as:

Risk that has been completely eliminated by security controls
The initial risk before any assessment is conducted
Risk that remains after security controls have been applied (Correct answer)
Risk transferred to a third-party insurer

Correct answer: Risk that remains after security controls have been applied

Residual risk is the level of risk that remains after risk mitigation controls have been implemented; it must be accepted by management.

Question 93: A ransomware attack has encrypted files on 200 workstations. According to IR best practices, what should the team do IMMEDIATELY after detection?

Disconnect affected systems from the network to prevent further spread (Correct answer)
Reimage all 200 workstations simultaneously
Pay the ransom to restore operations quickly
Notify all employees about the attack via company email

Correct answer: Disconnect affected systems from the network to prevent further spread

Immediate network isolation stops ransomware from spreading laterally to additional systems, limiting the blast radius before eradication and recovery begin.

Question 94: Which encryption cipher suite is mandatory in WPA2 and provides stronger security than TKIP?

TKIP
RC4
CCMP (AES) (Correct answer)
DES

Correct answer: CCMP (AES)

CCMP, based on AES in Counter Mode with CBC-MAC, is the mandatory cipher suite in WPA2 and provides data confidentiality, integrity, and replay protection superior to TKIP.

Question 95: How should a CND professional manager address underperformance within their team?

Publicly address the issue in team meetings
Immediately reassign the individual to a different role
Ignore it until formal review periods
Provide timely, specific feedback with support and a clear improvement plan (Correct answer)

Correct answer: Provide timely, specific feedback with support and a clear improvement plan

Question 96: What is threat hunting in a security operations context?

Proactive searching through networks and endpoints to detect threats that evade automated detection (Correct answer)
Responding to active security incidents as they are reported
Running penetration tests against production systems
Automated scanning of systems for known vulnerabilities

Correct answer: Proactive searching through networks and endpoints to detect threats that evade automated detection

Threat hunting is a proactive, human-driven process where analysts search for indicators of compromise or attacker behaviors that automated tools may have missed, assuming a breach may already exist.

Question 97: A security team uses Aircrack-ng to test their wireless network. After capturing the 4-way handshake, what additional step is required to attempt to recover the WPA2-PSK?

Perform ARP poisoning to redirect traffic through the attacker machine
Inject deauthentication frames to obtain the session key directly
Replay the handshake packets to force re-authentication
Run a dictionary or brute-force attack against the captured handshake offline (Correct answer)

Correct answer: Run a dictionary or brute-force attack against the captured handshake offline

Once the 4-way handshake is captured, Aircrack-ng performs offline dictionary or brute-force attacks by trying candidate passphrases through the PBKDF2-HMAC-SHA1 function to see if the computed MIC matches the captured one.

Question 98: Which federal law mandates that US government agencies implement information security programs and report to OMB annually?

SOX
FERPA
FISMA (Correct answer)
HIPAA

Correct answer: FISMA

The Federal Information Security Modernization Act (FISMA) requires federal agencies to develop, document, and implement agency-wide information security programs.

Question 99: When documenting assessment findings in CND practice, which approach is MOST appropriate?

Summarize findings verbally without written documentation
Record objective findings, measurements, and professional observations factually (Correct answer)
Use technical jargon that only experts can understand
Include only positive findings to maintain optimism

Correct answer: Record objective findings, measurements, and professional observations factually

Assessment documentation must be objective, factual, and comprehensive. Recording measurements, observations, and findings without bias ensures that the documentation is useful for decision-making and withstands scrutiny.

Question 100: What is a 'honeypot' used for in network forensics and threat analysis?

Caching web content
Luring attackers to study their techniques (Correct answer)
Distributing software patches
Storing encrypted credentials

Correct answer: Luring attackers to study their techniques

A honeypot is a deliberately vulnerable decoy system designed to attract attackers so their methods and tools can be observed and analyzed.

Certified Network Defender (CND) v2 Exam (312-38)

The CND certification validates the skills of network administrators to protect, detect, and respond to network attacks, ensuring network security.

100

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cert.eccouncil.org — Eligibility, fees, renewal, score validity, retake fee, exam format, passing score, time limit, exam information · verified Nov 2026
eccouncil.org — Test delivery · verified Oct 2026